add session inactivity timeout

and improve session_type naming (to "server-cache"/"client-cookie")